Jump to content
Калькуляторы

juniper ospf import policy

Привет всем!

Столкнулся с проблемой, не работает policy-options на import маршрутов в ospf.

Juniper MX80, JUNOS 12.3R4.6

routing-instances {
    NextOne {
        instance-type vrf;
        interface xe-0/0/0.4015;
        interface xe-0/0/0.4019;
        protocols {
            ospf {
                export ospf-vrf-NextOne-export;
                import ospf-vrf-NextOne-import;
                area 0.0.0.0 {
                    interface xe-0/0/0.4015 {
                        metric 150;
                        authentication {
                            md5 19 key "***"; ## SECRET-DATA
                        }
                    }
                    interface xe-0/0/0.4019 {
                        metric 150;
                        authentication {
                            md5 20 key "***"; ## SECRET-DATA
                        }
                    }
                }
            }
        }
    }
}
policy-options {
    policy-statement ospf-vrf-NextOne-import {
        term 1 {
            from {
                protocol ospf2;
                route-filter 83.167.66.225/32 exact;
                route-filter 83.167.66.226/32 exact;
                route-filter 10.100.101.118/32 exact;
                route-filter 83.167.66.1/32 exact;
                route-filter 83.167.66.5/32 exact;
                route-filter 83.167.66.9/32 exact;
                route-filter 83.167.66.10/32 exact;
                route-filter 83.167.66.16/32 exact;
                route-filter 83.167.66.19/32 exact;
                route-filter 83.167.72.1/32 exact;
                route-filter 83.167.81.1/32 exact;
                route-filter 83.167.88.1/32 exact;
                route-filter 10.100.101.44/30 orlonger;
                route-filter 83.167.65.0/24 orlonger;
                route-filter 83.167.66.160/29 orlonger;
                route-filter 83.167.66.164/30 orlonger;
            }
            then accept;
        }
        term 2 {
            then reject;                
        }
    }
}

Но в NextOne.inet.0 попадают маршруты, которые не должны туда попадать

Скрытый текст

> show route table NextOne.inet.0 protocol ospf

NextOne.inet.0: 3440 destinations, 3475 routes (3440 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.100.101.44/30   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
10.100.101.118/32  *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
10.222.255.52/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
10.222.255.56/30   *[OSPF/10] 6d 03:16:52, metric 162
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.0/24     *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.40/29    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.65.52/30    *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.56/30    *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.60/30    *[OSPF/150] 01:20:10, metric 20, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.5/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.8/32     *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.9/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.10/32    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.11/32    *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.12/32    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.13/32    *[OSPF/10] 6d 03:16:52, metric 162
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.16/32    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.22/32    *[OSPF/10] 6d 03:16:52, metric 163
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.32/30    *[OSPF/10] 6d 03:33:04, metric 160
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.36/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.40/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.44/30    *[OSPF/10] 2d 00:26:41, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.52/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.64/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.68/30    *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.72/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.80/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.84/30    *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.96/30    *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.100/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.104/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.108/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.120/30   *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.140/30   *[OSPF/10] 6d 03:16:52, metric 160
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.144/29   *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.152/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.156/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.160/30   *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.188/30   *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.225/32   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.226/32   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.236/31   *[OSPF/10] 6d 03:33:04, metric 180
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.244/31   *[OSPF/10] 6d 03:07:28, metric 300
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.246/31   *[OSPF/10] 6d 01:28:25, metric 300
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.248/31   *[OSPF/10] 6d 03:16:52, metric 180
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.252/31   *[OSPF/10] 6d 03:03:38, metric 300
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.254/31   *[OSPF/10] 6d 02:58:33, metric 300
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.67.4/30     *[OSPF/10] 6d 03:16:52, metric 160
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.72.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.88.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.160/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.164/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
172.16.0.172/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.180/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.1.32/30     *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
172.16.6.4/30      *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.6.16/30     *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.6.248/29    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.20.49.64/27    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
224.0.0.5/32       *[OSPF/10] 6d 03:43:55, metric 1
                      MultiRecv

 

Пробовал менять policy:

policy-options {
    policy-statement ospf-vrf-NextOne-import {
        term 2 {
            then reject;                
        }
    }

Однако, в NextOne.inet.0 попадают все те же маршруты.

Ребята-джуноводы, помогите, пожалуйста, советом. Как отфильтровать import ospf маршруты?

Share this post


Link to post
Share on other sites

Ну так, какие проходят мимо? external надеюсь фильтруешь? Хотя бы пару примеров приведи.

Share this post


Link to post
Share on other sites
2 hours ago, qelso said:

Привет всем!

Столкнулся с проблемой, не работает policy-options на import маршрутов в ospf.

Juniper MX80, JUNOS 12.3R4.6


routing-instances {
    NextOne {
        instance-type vrf;
        interface xe-0/0/0.4015;
        interface xe-0/0/0.4019;
        protocols {
            ospf {
                export ospf-vrf-NextOne-export;
                import ospf-vrf-NextOne-import;
                area 0.0.0.0 {
                    interface xe-0/0/0.4015 {
                        metric 150;
                        authentication {
                            md5 19 key "***"; ## SECRET-DATA
                        }
                    }
                    interface xe-0/0/0.4019 {
                        metric 150;
                        authentication {
                            md5 20 key "***"; ## SECRET-DATA
                        }
                    }
                }
            }
        }
    }
}
policy-options {
    policy-statement ospf-vrf-NextOne-import {
        term 1 {
            from {
                protocol ospf2;
                route-filter 83.167.66.225/32 exact;
                route-filter 83.167.66.226/32 exact;
                route-filter 10.100.101.118/32 exact;
                route-filter 83.167.66.1/32 exact;
                route-filter 83.167.66.5/32 exact;
                route-filter 83.167.66.9/32 exact;
                route-filter 83.167.66.10/32 exact;
                route-filter 83.167.66.16/32 exact;
                route-filter 83.167.66.19/32 exact;
                route-filter 83.167.72.1/32 exact;
                route-filter 83.167.81.1/32 exact;
                route-filter 83.167.88.1/32 exact;
                route-filter 10.100.101.44/30 orlonger;
                route-filter 83.167.65.0/24 orlonger;
                route-filter 83.167.66.160/29 orlonger;
                route-filter 83.167.66.164/30 orlonger;
            }
            then accept;
        }
        term 2 {
            then reject;                
        }
    }
}

Но в NextOne.inet.0 попадают маршруты, которые не должны туда попадать

  Reveal hidden contents

> show route table NextOne.inet.0 protocol ospf

NextOne.inet.0: 3440 destinations, 3475 routes (3440 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.100.101.44/30   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
10.100.101.118/32  *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
10.222.255.52/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
10.222.255.56/30   *[OSPF/10] 6d 03:16:52, metric 162
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.0/24     *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.40/29    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.65.52/30    *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.56/30    *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.65.60/30    *[OSPF/150] 01:20:10, metric 20, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.5/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.8/32     *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.9/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.10/32    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.11/32    *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.12/32    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.13/32    *[OSPF/10] 6d 03:16:52, metric 162
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.16/32    *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.22/32    *[OSPF/10] 6d 03:16:52, metric 163
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.32/30    *[OSPF/10] 6d 03:33:04, metric 160
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.36/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.40/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.44/30    *[OSPF/10] 2d 00:26:41, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.52/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.64/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.68/30    *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.72/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.80/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.84/30    *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.96/30    *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.100/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.104/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.108/30   *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.120/30   *[OSPF/10] 6d 03:33:04, metric 200
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.140/30   *[OSPF/10] 6d 03:16:52, metric 160
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.144/29   *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.152/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.156/30   *[OSPF/10] 6d 03:16:52, metric 200
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.160/30   *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.188/30   *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.66.225/32   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.226/32   *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.236/31   *[OSPF/10] 6d 03:33:04, metric 180
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.244/31   *[OSPF/10] 6d 03:07:28, metric 300
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.246/31   *[OSPF/10] 6d 01:28:25, metric 300
                    > to 83.167.66.238 via xe-0/0/0.4015
83.167.66.248/31   *[OSPF/10] 6d 03:16:52, metric 180
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.252/31   *[OSPF/10] 6d 03:03:38, metric 300
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.66.254/31   *[OSPF/10] 6d 02:58:33, metric 300
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.67.4/30     *[OSPF/10] 6d 03:16:52, metric 160
                    > to 83.167.66.250 via xe-0/0/0.4019
83.167.72.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
83.167.88.1/32     *[OSPF/150] 01:20:10, metric 120, tag 0
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.160/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.164/30    *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
172.16.0.172/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.0.180/30    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.1.32/30     *[OSPF/10] 6d 03:16:52, metric 161
                      to 83.167.66.250 via xe-0/0/0.4019
                    > to 83.167.66.238 via xe-0/0/0.4015
172.16.6.4/30      *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.6.16/30     *[OSPF/10] 6d 03:16:52, metric 162
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.16.6.248/29    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
172.20.49.64/27    *[OSPF/10] 6d 03:16:52, metric 161
                    > to 83.167.66.250 via xe-0/0/0.4019
                      to 83.167.66.238 via xe-0/0/0.4015
224.0.0.5/32       *[OSPF/10] 6d 03:43:55, metric 1
                      MultiRecv

 

Пробовал менять policy:


policy-options {
    policy-statement ospf-vrf-NextOne-import {
        term 2 {
            then reject;                
        }
    }

Однако, в NextOne.inet.0 попадают все те же маршруты.

Ребята-джуноводы, помогите, пожалуйста, советом. Как отфильтровать import ospf маршруты?

А что вы фильтруете ? Вы учли что  


The filtering is done only on external routes in OSPF. The intra-area and interarea routes are not considered for filtering.

 

Share this post


Link to post
Share on other sites

@vvertexx , верное замечание. Сразу не обратил внимание, LSA5 фильтруются. Помимо разрешенных в policy-options маршрутов, прилетают LSA 3, которые согласно policy-options, не должны попадать в таблицу.

Видимо, @orlik прав:

The filtering is done only on external routes in OSPF. The intra-area and interarea routes are not considered for filtering.

Коллеги подсказывают:

"you are correct in that you cannot filter intra-area routes with the ospf import statement. However, you could configure the routes as martians under routing-options to prevent them from being installed in the routing table."

 

Но что-то не хочется городить.

Есть идеи, помимо the routes as martians? Или смириться?

Share this post


Link to post
Share on other sites

Inter-area можно фильтровать на границах area, но делается это не через import-policy а через area-range в соответствующей area.

Share this post


Link to post
Share on other sites

@v_r , спасибо. Но мне это не подходит, данный джун не ABR.

Не смотря на это попробовал заюзать area-range вместе с network-summary-import - не помогло.

Share this post


Link to post
Share on other sites

На крайний случай можно через

 routing-options forwarding-table export <policy>

предотвратить установку конкретных роутов в pfe. Но зачем?

Share this post


Link to post
Share on other sites
11 hours ago, Mystray said:

На крайний случай можно через


 routing-options forwarding-table export <policy>

предотвратить установку конкретных роутов в pfe. Но зачем?

+1 полностью поддерживаю , если очень мешают можно не инставить в фиб

Share this post


Link to post
Share on other sites

@Mystray@orlik, чтобы клиенты из этого vrf могли ходить только на разрешенные хосты. Решили пока забить, т.к. ничего страшного не должно произойти. Но за наводку спасибо, буду иметь ввиду.

Share this post


Link to post
Share on other sites

ACL на интерфейсе не решит задачу?

Share this post


Link to post
Share on other sites

@v_r, не знаю, пока нет времени продумывать это. Пусть пока так работает. Но за совет, спасибо.

Тему можно считать закрытой.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this